PHP CGI Argument Injection (CVE-2024-4577): Critical Windows Server Vulnerability Post-Mortem

Understanding the Attack Vector in CVE-2024-4577

In June 2024, security researchers disclosed CVE-2024-4577, an unauthenticated Remote Code Execution (RCE) vulnerability carrying a CVSS score of 9.8. The flaw affects PHP running in CGI mode on Microsoft Windows operating systems. Under specific Windows code pages (such as Traditional Chinese, Simplified Chinese, or Japanese), the Windows Unicode Best-Fit mapping converts soft hyphens (0xAD) into standard ASCII hyphens (0x2D).

This character mapping bypasses previous security fixes for CVE-2012-1823, allowing remote threat actors to pass command-line arguments to the PHP binary itself via the HTTP query string, including -d allow_url_include=1 -d auto_prepend_file=php://input, achieving immediate arbitrary code execution.

Immediate Remediation Steps for Windows Servers

1. Upgrade PHP Instantly: Upgrade to PHP 8.1.29, 8.2.20, 8.3.8, or PHP 8.4 where the Best-Fit mapping is explicitly neutralized.
2. Migrate from CGI to FastCGI/PHP-FPM: Never execute PHP via legacy CGI (php.exe or php-cgi.exe) in Apache. Switch to mod_fcgid or IIS FastCGI.
3. Implement ModSecurity Web Application Firewall (WAF) Rules: Block query strings containing encoded hyphen characters and command-line parameters.

# Apache Rewrite Rule to mitigate CVE-2024-4577
RewriteEngine On
RewriteCond %{QUERY_STRING} ^(%ad|%AD) [NC]
RewriteRule .* - [F,L]